Techniques to verify and authenticate resources in a data center computer environment
Embodiments are generally directed apparatuses, methods, techniques and so forth to receive a sled manifest comprising identifiers for physical resources of a sled, receive results of an authentication and validation operations performed to authenticate and validate the physical resources of the sled, determine whether the results of the authentication and validation operations indicate the physical resources are authenticate or not authenticate. Further and in response to the determination that the results indicate the physical resources are authenticated, permit the physical resources to process a workload, and in response to the determination that the results indicate the physical resources are not authenticated, prevent the physical resources from processing the workload.
1. An apparatus, comprising:
a processor; and
memory comprising instructions for a pod management controller that when executed by the processor cause the processor to:
determine whether a sled manifest and results are authentic and valid, the results generated by an authentication and validation operation performed to authenticate and validate physical resources of a sled, the authentication and validation operation to generate a nonce, communicate the nonce to at least one of the physical resources of the sled, and authenticate a signed version of the nonce received from the at least one physical resource in response;
determine whether the results of the authentication and validation operation indicate the physical resources are authentic and valid;
permit the physical resources to process a workload in response to a determination that the sled manifest and results are authentic and valid, and the results indicate the physical resources are authentic and valid; and
prevent the physical resources from processing the workload in response to a determination that at least one of the sled manifest is not authentic and valid, the results are not authentic and valid, and the results indicate the physical resources are not authentic and valid.
2. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to:
receive the sled manifest comprising identifiers for the physical resources from the sled; and
receive the results of the authentication and validation operation performed to authenticate and validate the physical resources from the sled.
3. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to authenticate the sled manifest using a public key, the public key obtained from an original manufacturer of the sled or a trusted third party.
4. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to:
generate a hash value based on the sled manifest;
compare the hash value with another hash value communicated with the results;
validate the sled manifest when the hash value and the other hash value match; and
invalidate the sled manifest when the hash value and the other hash value do not match.
5. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to authenticate the results using a public key, the public key obtained from the sled manifest.
6. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to add an indication of the physical resources in a database to permit the physical resources to process the workload.
7. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to receive the sled manifest and the results of the authentication and verification operations via a secure link with the sled.
8. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to generate a composed node comprising at least one of the physical resources of the sled.
9. The apparatus of claim 1 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to:
send a platform certificate request to generate a platform certificate for a composed node to a certificate authority, the platform certificate to identify physical resources including the at least one of the physical resources used for the composed node; and
receive a signed platform certificate.
10. The apparatus of claim 9 , the memory comprising instructions for the pod management controller that when executed by the processor cause the processor to send the signed platform certificate for the composed node to a client device.
11. A non-transitory computer-readable storage medium, comprising a plurality of instructions, that when executed, enable processing circuitry to:
determine whether a sled manifest and results are authentic and valid, the results generated by an authentication and validation operation performed to authenticate and validate physical resources of a sled, the authentication and validation operation to generate a nonce, communicate the nonce to at least one of the physical resources of the sled, and authenticate a signed version of the nonce received from the at least one physical resource in response;
determine whether the results of the authentication and validation operation indicate the physical resources are authentic and valid;
permit the physical resources to process a workload in response to a determination that the sled manifest and results are authentic and valid, and the results indicate the physical resources are authentic and valid; and
prevent the physical resources from processing the workload in response to a determination that at least one of the sled manifest is not authentic and valid, the results are not authentic and valid, and the results indicate the physical resources are not authentic and valid.
12. The non-transitory computer-readable storage medium of claim 11 , comprising a plurality of instructions, that when executed, enable processing circuitry to:
receive the sled manifest comprising identifiers for the physical resources from the sled; and
receive the results of the authentication and validation operation performed to authenticate and validate the physical resources from the sled.
13. The non-transitory computer-readable storage medium of claim 11 , comprising a plurality of instructions, that when executed, enable processing circuitry to authenticate the sled manifest using a public key, the public key obtained from an original manufacturer of the sled or a trusted third party.
14. The non-transitory computer-readable storage medium of claim 11 , comprising a plurality of instructions, that when executed, enable processing circuitry to:
generate a hash value based on the sled manifest;
compare the hash value with another hash value communicated with the results;
validate the sled manifest when the hash value and the other hash value match; and
invalidate the sled manifest when the hash value and the other hash value do not match.
15. The non-transitory computer-readable storage medium of claim 11 , comprising a plurality of instructions, that when executed, enable processing circuitry to authenticate the results using a public key, the public key obtained from the sled manifest.
16. The non-transitory computer-readable storage medium of claim 11 , comprising a plurality of instructions, that when executed, enable processing circuitry to add an indication of the physical resources in a database to permit the physical resources to process the workload.
17. The non-transitory computer-readable storage medium of claim 11 , comprising a plurality of instructions, that when executed, enable processing circuitry to receive the sled manifest and the results of the authentication and verification operations via a secure link with the sled.
18. The non-transitory computer-readable storage medium of claim 11 , comprising a plurality of instructions, that when executed, enable processing circuitry to generate a composed node comprising at least one of the physical resources of the sled.
19. The non-transitory computer-readable storage medium of claim 11 , comprising a plurality of instructions, that when executed, enable processing circuitry to:
send a platform certificate request to generate a platform certificate for a composed node to a certificate authority, the platform certificate to identify physical resources including the at least one of the physical resources used for the composed node; and
receive a signed platform certificate.
20. The non-transitory computer-readable storage medium of claim 19 , comprising a plurality of instructions, that when executed, enable processing circuitry to send the signed platform certificate for the composed node to a client device.
21. A computer-implemented method to verify and authentic physical resources, comprising:
determining whether a sled manifest and results are authentic and valid, the results generated by an authentication and validation operation performed to authenticate and validate physical resources of a sled, the authentication and validation operation to generate a nonce, communicate the nonce to at least one of the physical resources of the sled, and authenticate a signed version of the nonce received from the at least one physical resource in response;
determining whether the results of the authentication and validation operation indicate the physical resources are authentic and valid;
permitting the physical resources to process a workload in response to a determination that the sled manifest and results are authentic and valid, and the results indicate the physical resources are authentic and valid; and
preventing the physical resources from processing the workload in response to a determination that at least one of the sled manifest is not authentic and valid, the results are not authentic and valid, and the results indicate the physical resources are not authentic and valid.
22. The computer-implemented method of claim 21 , comprising:
receiving the sled manifest comprising identifiers for the physical resources from the sled;
authenticating the sled manifest using a public key, the public key obtained from an original manufacturer of the sled or a trusted third party; and
receiving the results of the authentication and validation operation performed to authenticate; and
authenticating the results using a public key, the public key obtained from the sled manifest and validating the physical resources from the sled.
23. The computer-implemented method of claim 21 , comprising:
generating a hash value based on the sled manifest;
comparing the hash value with another hash value communicated with the results;
validating the sled manifest when the hash value and the other hash value match; and
invalidating the sled manifest when the hash value and the other hash value do not match.
24. The computer-implemented method of claim 21 , comprising:
adding an indication of the physical resources in a database to permit the physical resources to process the workload.
25. The computer-implemented method of claim 21 , comprising:
generating a composed node comprising at least one of the physical resources of the sled.